Privacy Policy

My Secret Santa helps adults organize gift exchanges with people they know, such as friends, family, classmates, or coworkers.

The app is not directed to children under 13. Please do not use it to collect information from children without appropriate parent or guardian involvement.

We collect the account details you provide, such as your name, email address, profile settings, avatar, notification choices, and sign-in details from Google or email authentication.

When you use the app, we store group details, invitations, wishlist items, gift assignments, private group messages, gift progress, reminders, notifications, and activity needed to run the exchange.

We use cookies and limited browser storage to keep you signed in, remember safe app preferences, and restore recent page state. We do not use these tools to sell your personal data.

We use your data to sign you in, keep your groups private, send invite or reminder messages, show wishlist clues, draw names, and help members manage their gift exchange.

We also keep security and audit records for sensitive actions such as invite handling, report access, rate limits, affiliate events, account deletion, and suspicious activity.

Some shopping buttons and links may be affiliate links. If you buy after opening one, My Secret Santa may earn a commission at no extra cost to you.

When you open a shopping link, the app can record the click, the related group or wishlist context, and any conversion details later reported by the affiliate network.

Affiliate reporting is owner-only and is used to understand which shopping links were opened or later reported by a shopping partner such as Lazada, Shopee, or Amazon. Search-style links do not tell the app which exact product you choose inside the store unless the partner later reports a matching conversion.

Once you leave My Secret Santa for a store such as Lazada, Shopee, or Amazon, that store's own privacy policy and checkout rules apply.

As an Amazon Associate I earn from qualifying purchases.

The app may link to an optional tip jar to help support hosting and maintenance.

Tips are never required to use the app and do not change gift draws, privacy, feature access, or support priority.

If you open a tip link, payment details are handled by the external tip provider under that provider's own privacy and payment rules.

Wishlist suggestion features may send limited wishlist or gift-preference text to configured AI providers when that feature is enabled.

The app sends only the details needed for the suggestion, excludes private item notes from provider prompts, and keeps provider API keys on the server, never in the browser.

We may send transactional emails such as account confirmation, password reset, welcome, invite, and reminder messages.

You can update many notification choices in your profile. Transactional or security messages may still be sent when needed to run the app safely.

The app is built with Vercel for hosting and Supabase for authentication and database storage. It may also use Google sign-in, email delivery, AI, and affiliate providers where those features are enabled.

These services process data so the app can run. We do not sell your group, wishlist, assignment, message, or profile data.

You can update your profile, notification choices, wishlist items, and many group details inside the app.

You can request account deletion from your profile. Deletion removes your account and linked personal records where the app can safely remove them, but some security, audit, or affiliate records may be retained when needed to protect the service, prevent abuse, or satisfy reporting obligations.

For privacy, deletion, or security requests, contact mysecretsanta.notifications@gmail.com.

The app uses managed authentication, server-side authorization checks, Row Level Security, rate limits, and restrictive security headers to reduce common risks.

No system is perfect. Report suspected security or privacy issues to the app owner so they can be investigated quickly.